CVE-2026-89020
Last modified
CVE-2026-89020 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MikroTik | RouterOS | >= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24.0, < 7.24.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-89020?
How severe is CVE-2026-89020?
How do I fix CVE-2026-89020?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89011isomorphic-git before 1.42.0 contains a prototype pollution …7.1
- CVE-2026-89012Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive deny…6.5
- CVE-2026-89013Dolibarr 23.0.4 before 24.0.1 contains an authorization bypa…7.5
- CVE-2026-89017Skyline DataMiner BrokerGateway contains an embedded API key…7.5
- CVE-2026-89019Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-8902The AJAX Report Comments plugin for WordPress is vulnerable …4.3
- CVE-2026-89021MikroTik RouterOS before 7.24.2 contains a path traversal vu…6.9
- CVE-2026-89022BookStack before 26.05.5 contains an authentication bypass v…7.4
- CVE-2026-89023ThemeAtelier Domain For Sale plugin for WordPress before 3.5…8.6
- CVE-2026-89025Hirschmann HiOS Switch Platform devices contain a denial-of-…7.5
- CVE-2026-89026The Issabel Framework, the web framework supporting Issabel …9.8
- CVE-2026-89027miniOrange JWT Authentication for WP REST APIs plugin for Wo…6.5
Are you affected by CVE-2026-89020?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST